Opinion Stage WordPress Plugin Poll, Survey & Quiz Maker Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress, affecting all versions through 19.12.0. The vulnerability arises from inadequate nonce validation in the 'disconnect_account_action' function, allowing unauthenticated attackers to disconnect a site from the Opinion Stage platform. This could be achieved by tricking a site administrator into clicking a link that triggers the forged request.
Impact
Exploitation of this vulnerability allows for unauthorized disconnection of a WordPress site from the Opinion Stage platform integration, potentially disrupting any active polls, surveys, or quizzes managed through the plugin.
Remediation
Users can update to version 19.12.1 or a newer patched version to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.